Adding a Table to Group Source IP Addresses by Event Fidelity

To add a table that groups source IP addresses by fidelity to your custom dashboard:

  1. Click the Visualize menu and locate the Custom menu block.

  2. Click the dashboard you want to edit. The dashboard appears.

  3. Click Edit. The display switches to the editing canvas.

  4. Click New table. The Chart Builder dialog box appears.

  5. Enter the Chart Name. Ours is Source IPs by Fidelity. This field does not support multibyte characters.

    Special characters are not permitted in name fields for Queries, Lookup lists, Reports/Dashboards. Letters, underscores, spaces, dashes, numbers and periods are permitted.

  6. Choose the Tenant. We chose All Tenants.

  7. Choose the Indices. We chose Security Events.

  8. Leave the query as None. The query is optional.

  9. Choose Groupings for the Table Type.

  10. Click Next. The Groupings tab appears.

  11. Click + Add Grouping twice to add a total of three groupings. The groupings are processed sequentially, and you can move them to change the configuration.

  12. Open the Column 1 grouping.

  13. Enter a better Column Label. We chose Fidelity.

  14. Choose Range for the Aggregation.

  15. Choose fidelity for the Field.

  16. Click + Add Grouping thrice.

  17. For the first range:

    1. Name: less than 30

    2. ≥: 0

    3. <: 30

  18. For the second range:

    1. Name: 30 to 70

    2. ≥: 30

    3. <: 70

  19. For the third range:

    1. Name: greater than 70

    2. ≥: 70

    3. <: 100

  20. Open the Column 2 grouping.

  21. Enter a Column Label. We chose Source IP Address.

  22. For the remaining fields:

    • Aggregation: Term

    • Field: srcip

    • Metric: Count

    • Order: Descending

    • Size: 5

  23. Open the Column 3 grouping.

  24. Enter a Column Label. We chose Number.

  25. For the remaining fields:

    • Aggregation: Metric

    • Metric: Count

  26. Click Next. The Options tab appears.

  27. Click Submit. The table is added and the editing canvas appears.

  28. Click Save. The dashboard appears with your new table.